\n * <post url>\n * - $10 (santa rosa)\n *\n * The price line is optional (free items have none) and the parenthesised neighbourhood\n * is optional too; a free item may carry only the parenthesised location.\n *\n * Two URL shapes exist. Craigslist switched on 2026-07-02:\n * new: https://www.craigslist.org/view/d/<slug>/<uuid>\n * legacy: https://sfbay.craigslist.org/eby/hsh/d/<slug>/<pid>.html\n * Legacy rows carry a numeric post id and no uuid; the judge resolves the uuid later by\n * following the 301 on the old URL.\n */\n\nexport interface ParsedResult {\n uuid: string | null;\n pid: number | null;\n slug: string;\n title: string;\n price: number | null;\n hood: string | null;\n /** The 11-char image identity from the alert's _300x300 thumbnail, when there is one. */\n thumbImgId: string | null;\n url: string;\n}\n\nexport interface ParsedAlert {\n /** Saved-search name, lowercased — this is the key criteria are stored under. */\n search: string;\n /** N from \"(N new results)\", or null if the subject did not parse. */\n count: number | null;\n results: ParsedResult[];\n}\n\nconst NEW_URL =\n /https?:\\/\\/(?:www\\.)?craigslist\\.org\\/view\\/d\\/([^/\\s\"'<>]+)\\/([A-Za-z0-9]{15,30})/;\nconst LEGACY_URL =\n /https?:\\/\\/[a-z0-9.-]*craigslist\\.org\\/(?:[a-z0-9]+\\/)*d\\/([^/\\s\"'<>]+)\\/(\\d{6,})\\.html/;\n/** \"- $10 (santa rosa)\", \"- $4,500.00 (rockridge)\", \"- $20\". Cents are real: alerts carry them. */\nconst PRICE_LINE = /^-\\s*\\$([\\d,]+(?:\\.\\d+)?)(?:\\s*\$(.+)\$)?\\s*$/;\nconst THUMB = /images\\.craigslist\\.org\\/[0-9A-Za-z]+_([0-9A-Za-z]{8,14})_[0-9A-Za-z]+_\\d+x\\d+\\.jpg/;\n\n/** \"(2 new results) some saved search\" -> {count: 2, search: \"some saved search\"} */\nexport function parseSubject(\n subject: string | undefined,\n): { count: number; search: string } | null {\n if (!subject) return null;\n const m = subject.match(/\$(\\d+)\\s+new\\s+results?\$\\s*(.+)$/i);\n if (!m) return null;\n const search = m[2].trim().toLowerCase();\n if (!search) return null;\n return { count: Number(m[1]), search };\n}\n\n/** Identity key for a result: the uuid when we have one, otherwise \"pid:<n>\". */\nexport function resultKey(r: { uuid: string | null; pid: number | null }): string {\n return r.uuid ?? `pid:${r.pid}`;\n}\n\nexport function parseAlert(\n subject: string | undefined,\n text: string | undefined,\n html: string | undefined,\n): ParsedAlert {\n const sub = parseSubject(subject);\n // The text part is the one to trust — it is simpler and survives forward-wrapping better.\n // The HTML part carries the same links, titles and prices, so it is the fallback for a\n // forward that dropped or mangled the text alternative.\n let results = text ? parseTextPart(text) : [];\n if (!results.length && html) results = parseHtmlPart(html);\n const thumbs = html ? thumbnailsByKey(html) : new Map<string, string>();\n for (const r of results) {\n r.thumbImgId = thumbs.get(resultKey(r)) ?? null;\n }\n return { search: sub?.search ?? \"\", count: sub?.count ?? null, results };\n}\n\nfunction parseTextPart(text: string): ParsedResult[] {\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n let title: string | null = null;\n let block: string[] = [];\n\n const flush = () => {\n if (title) {\n const r = blockToResult(title, block);\n if (r && !seen.has(resultKey(r))) {\n seen.add(resultKey(r));\n out.push(r);\n }\n }\n title = null;\n block = [];\n };\n\n for (const raw of text.split(/\\r?\\n/)) {\n const sep = raw.match(/^={5,}\\s*(.*)$/);\n if (sep) {\n flush();\n title = sep[1].trim() || null;\n } else if (title) {\n block.push(raw.trim());\n }\n }\n flush();\n return out;\n}\n\nfunction blockToResult(title: string, lines: string[]): ParsedResult | null {\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n let url = \"\";\n\n for (const line of lines) {\n const nu = line.match(NEW_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n url = nu[0];\n break;\n }\n const lu = line.match(LEGACY_URL);\n if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n url = lu[0];\n break;\n }\n }\n if (!url) return null;\n\n let price: number | null = null;\n let hood: string | null = null;\n for (const line of lines) {\n const p = line.match(PRICE_LINE);\n if (p) {\n price = Number(p[1].replace(/,/g, \"\"));\n hood = p[2]?.trim() || null;\n break;\n }\n const h = line.match(/^\$(.+)\$\\s*$/);\n if (h) {\n hood = h[1].trim();\n break;\n }\n }\n\n return { uuid, pid, slug, title, price, hood, thumbImgId: null, url };\n}\n\n/**\n * Thumbnail image ids from the HTML part, matched to results by document order: each\n * <img> belongs to the most recent post link above it, which is how the alert is laid out\n * (the thumbnail is wrapped in a second anchor to the same post).\n */\nfunction thumbnailsByKey(html: string): Map<string, string> {\n const combined = new RegExp(\n `(?:${NEW_URL.source})|(?:${LEGACY_URL.source})|(?:${THUMB.source})`,\n \"g\",\n );\n const map = new Map<string, string>();\n let current: string | null = null;\n for (const m of html.matchAll(combined)) {\n // groups: 1,2 = new slug/uuid 3,4 = legacy slug/pid 5 = thumbnail image id\n if (m[2]) current = m[2];\n else if (m[4]) current = `pid:${Number(m[4])}`;\n else if (m[5] && current && !map.has(current)) map.set(current, m[5]);\n }\n return map;\n}\n\n/**\n * Fallback parse of the HTML part. One result per post anchor:\n * <a href=\"<post url>\">title</a> - $10 <small>(santa rosa)</small>\n * The thumbnail below it is a second anchor to the same post whose content is an <img>, so it\n * yields no title and is dropped by the first-wins dedup.\n */\nfunction parseHtmlPart(html: string): ParsedResult[] {\n const anchor = /<a\\s[^>]*href=\"([^\"]+)\"[^>]*>([\\s\\S]*?)<\\/a>/gi;\n const matches = [...html.matchAll(anchor)];\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n\n for (let i = 0; i < matches.length; i++) {\n const m = matches[i];\n const href = m[1];\n const title = stripTags(m[2]);\n if (!title) continue;\n\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n const nu = href.match(NEW_URL);\n const lu = nu ? null : href.match(LEGACY_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n } else if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n } else {\n continue;\n }\n\n // Price and neighbourhood sit between this anchor and the next one.\n const from = m.index! + m[0].length;\n const to = i + 1 < matches.length ? matches[i + 1].index! : html.length;\n const between = html.slice(from, to);\n const pm = between.match(/-\\s*\\$([\\d,]+(?:\\.\\d+)?)/);\n const hm = between.match(/<small>\\s*\$([^)]*)\$\\s*<\\/small>/i) ??\n between.match(/\$([^)<]+)\$/);\n\n const r: ParsedResult = {\n uuid,\n pid,\n slug,\n title,\n price: pm ? Number(pm[1].replace(/,/g, \"\")) : null,\n hood: hm ? hm[1].replace(/\\s+/g, \" \").trim() || null : null,\n thumbImgId: null,\n url: href,\n };\n if (seen.has(resultKey(r))) continue;\n seen.add(resultKey(r));\n out.push(r);\n }\n return out;\n}\n\nfunction stripTags(s: string): string {\n return s.replace(/<[^>]*>/g, \"\").replace(/&/g, \"&\").replace(/\\s+/g, \" \").trim();\n}\n","label",[173,65],"lib","pulls","branches",1,"forks","envVars",{"_182":184,"_185":26},"connections",{"_182":26,"_183":26},"count","unfilledCount",3,"emptyCount",{"_34":319,"_13":173,"_63":164,"_44":-5,"_36":37,"_165":176,"_166":102,"_38":320,"_40":26,"_66":321,"_169":-5,"_68":24,"_171":-5,"_210":322,"_17":323},{"_34":311,"_13":312,"_63":313,"_44":164,"_36":37,"_165":314,"_166":102,"_38":315,"_40":26,"_66":67,"_169":316,"_68":24,"_171":-5,"_210":317,"_17":318},{"_34":303,"_13":304,"_63":305,"_44":164,"_36":37,"_165":306,"_166":102,"_38":307,"_40":265,"_66":67,"_169":308,"_68":24,"_171":-5,"_210":309,"_17":310},{"_34":295,"_13":296,"_63":297,"_44":164,"_36":37,"_165":298,"_166":102,"_38":299,"_40":176,"_66":67,"_169":300,"_68":24,"_171":-5,"_210":301,"_17":302},{"_34":288,"_13":289,"_63":290,"_44":164,"_36":37,"_165":128,"_166":102,"_38":291,"_40":184,"_66":67,"_169":292,"_68":24,"_171":-5,"_210":293,"_17":294},{"_34":280,"_13":281,"_63":282,"_44":164,"_36":37,"_165":283,"_166":102,"_38":284,"_40":176,"_66":67,"_169":285,"_68":24,"_171":-5,"_210":286,"_17":287},{"_34":273,"_13":274,"_63":275,"_44":164,"_36":37,"_165":207,"_166":102,"_38":276,"_40":26,"_66":67,"_169":277,"_68":24,"_171":-5,"_210":278,"_17":279},{"_34":163,"_13":65,"_63":64,"_44":164,"_36":37,"_165":82,"_166":102,"_38":270,"_40":168,"_66":67,"_169":170,"_68":24,"_171":-5,"_210":271,"_17":272},{"_34":262,"_13":263,"_63":264,"_44":164,"_36":37,"_165":265,"_166":102,"_38":266,"_40":26,"_66":67,"_169":267,"_68":24,"_171":-5,"_210":268,"_17":269},{"_34":254,"_13":255,"_63":256,"_44":-5,"_36":37,"_165":257,"_166":102,"_38":258,"_40":26,"_66":21,"_169":259,"_68":24,"_171":-5,"_210":260,"_17":261},{"_34":246,"_13":247,"_63":248,"_44":-5,"_36":37,"_165":249,"_166":102,"_38":250,"_40":176,"_66":21,"_169":251,"_68":24,"_171":-5,"_210":252,"_17":253},{"_34":238,"_13":239,"_63":240,"_44":-5,"_36":37,"_165":241,"_166":102,"_38":242,"_40":176,"_66":21,"_169":243,"_68":24,"_171":-5,"_210":244,"_17":245},{"_34":230,"_13":231,"_63":232,"_44":-5,"_36":37,"_165":233,"_166":102,"_38":234,"_40":176,"_66":21,"_169":235,"_68":24,"_171":-5,"_210":236,"_17":237},{"_34":222,"_13":223,"_63":100,"_44":-5,"_36":37,"_165":224,"_166":102,"_38":225,"_40":176,"_66":226,"_169":227,"_68":24,"_171":-5,"_210":228,"_17":229},{"_34":213,"_13":214,"_63":215,"_44":-5,"_36":37,"_165":216,"_166":102,"_38":217,"_40":168,"_66":218,"_169":219,"_68":24,"_171":-5,"_210":220,"_17":221},{"_34":202,"_13":203,"_63":204,"_44":-5,"_36":37,"_165":205,"_166":102,"_38":206,"_40":207,"_66":208,"_169":209,"_68":24,"_171":-5,"_210":211,"_17":212},"ced6acc7-3bcd-4483-b0d7-3cdc93bd3220","judge.cron.tsx","e81164fa-ace8-11f1-b8ae-1607ee4eb77e",45,["D",1789029030979],6,"interval","/**\n * [2] The cron. Overflow only.\n *\n * The email handler judges inline, so on a normal one-result alert this cron finds nothing to\n * do. It exists for the cases the inline path cannot cover: the rest of a multi-result alert\n * (only one expensive post fits in a single 40 s budget), the backlog from the first activation,\n * posts that failed and went back on the queue, and anything a dry run rehearsed while there\n * was no API key. Free-tier minimum interval is 15 minutes; schedules live in the Val Town UI.\n *\n * All the logic is in lib/drain.ts so that both entry points behave identically.\n */\nimport { drain } from \"./lib/drain.ts\";\n\nconst MAX_POSTS = 4;\n\nexport default async function (): Promise<void> {\n await drain({ started: Date.now(), maxPosts: MAX_POSTS });\n}\n","children",[],[203],"d0d7ddf8-73eb-4f33-a790-61f35c50adb9","inbox.email.tsx","e7fd2184-ace8-11f1-8bd6-1607ee4eb77e",44,["D",1789029030972],"email","/**\n * [1] Email trigger. Parses a Craigslist saved-search alert, does the cheap dedup that needs\n * no network, enqueues the survivors — and then judges them inline. His alerts are almost\n * always a single result, and making him wait up to fifteen minutes for a cron to notice is\n * latency for nothing.\n *\n * Judging inline is only safe because the drain budgets itself against the *handler's* start\n * time, not its own: parse and enqueue come out of the same 40 s, and a post is only started\n * with >= 38 s of it left. So a slow parse simply means drain judges nothing and the cron picks\n * it up; a multi-result alert gets one post now and the rest on the next cron. Neither case can\n * push this handler near the 60 s cap that would get the val paused.\n *\n * Anyone can send mail to this address and the val is public, so the sender is checked here.\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { drain } from \"./lib/drain.ts\";\nimport { parseAlert, parseSubject, resultKey } from \"./lib/parse.ts\";\nimport * as db from \"./lib/db.ts\";\n\nconst ALERTS_FROM = \"alerts@alerts.craigslist.org\";\nconst MAX_POSTS = 4;\n\nexport interface Email {\n from: string;\n to: string[];\n cc?: string | string[];\n bcc?: string | string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments?: File[];\n headers?: Record<string, string>;\n}\n\n/** \"craigslist <alerts@alerts.craigslist.org>\" -> \"alerts@alerts.craigslist.org\" */\nfunction addrOf(s: string | undefined): string {\n if (!s) return \"\";\n const m = s.match(/<([^>]+)>/);\n return (m ? m[1] : s).trim().toLowerCase();\n}\n\nexport default function (e: Email): Promise<void> {\n return handleEmail(e);\n}\n\n/** Exported so the same path can be exercised without actually sending mail. */\nexport async function handleEmail(e: Email): Promise<void> {\n const started = Date.now();\n const from = addrOf(e.from);\n const senderMatches = from === ALERTS_FROM;\n\n // Gmail filter-forwarding normally preserves the original From. If it ever wraps instead,\n // the original address survives in the forwarded headers or in the body text.\n const inHeaders = Object.values(e.headers ?? {}).some((v) =>\n String(v).toLowerCase().includes(ALERTS_FROM)\n );\n const inBody = `${e.text ?? \"\"}${e.html ?? \"\"}`.toLowerCase().includes(ALERTS_FROM);\n\n const sub = parseSubject(e.subject);\n const alert = parseAlert(e.subject, e.text, e.html);\n const looksLikeAlert = sub !== null && alert.results.length > 0;\n\n // A body mention alone is not enough: anyone can type that address into an email. It has to\n // parse as a real alert as well.\n const accept = senderMatches ? true : ((inHeaders || inBody) && looksLikeAlert);\n\n if (!accept) {\n const record = {\n at: new Date().toISOString(),\n from: e.from ?? \"\",\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n };\n // Gmail's forwarding-verification code lands here; read it with blob.getJSON.\n await blob.setJSON(\"last-other-email\", record);\n console.log(\"OTHER_EMAIL\", JSON.stringify({ from: record.from, subject: record.subject }));\n return;\n }\n\n if (!looksLikeAlert) {\n await blob.setJSON(\"last-unparsed-alert\", {\n at: new Date().toISOString(),\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n });\n console.log(\"ALERT_PARSE_EMPTY\", JSON.stringify({ subject: e.subject ?? \"\" }));\n return;\n }\n\n await db.init();\n let queued = 0;\n const skipped: string[] = [];\n\n for (const r of alert.results) {\n const key = resultKey(r);\n const reason = await skipReason(key, r.pid, r.thumbImgId);\n if (reason) {\n skipped.push(`${key}:${reason}`);\n continue;\n }\n await db.insertQueued({\n uuid: key,\n pid: r.pid,\n search: alert.search,\n title: r.title,\n price: r.price,\n hood: r.hood,\n thumbImgId: r.thumbImgId,\n url: r.url,\n });\n queued++;\n }\n\n console.log(\n \"ALERT\",\n JSON.stringify({\n search: alert.search,\n claimed: alert.count,\n parsed: alert.results.length,\n queued,\n skipped,\n }),\n );\n\n // Judge what we just queued, on this alert's own clock. Nothing to queue means nothing to do:\n // a re-alert of a post we already know about must not trigger a drain.\n if (queued > 0) await drain({ started, maxPosts: MAX_POSTS });\n}\n\n/** Everything here is local to SQLite — no craigslist request is made before the cron runs. */\nasync function skipReason(\n key: string,\n pid: number | null,\n thumbImgId: string | null,\n): Promise<string | null> {\n if (await db.getPost(key)) return \"known\";\n if (pid !== null) {\n if (await db.existsPid(pid)) return \"pid-known\";\n if (await db.isBlocked([`pid:${pid}`])) return \"pid-blocked\";\n }\n if (thumbImgId) {\n if (await db.isBlocked([`img:${thumbImgId}`])) return \"img-blocked\";\n if (await db.existsImage(thumbImgId)) return \"img-known\";\n }\n return null;\n}\n",[],[214],"b6027742-6bd3-40ea-ba83-9aece7305792","feedback.http.tsx",61,["D",1789030852243],"http","/**\n * [3] The nope / more-like-this buttons in the digest.\n *\n * GET ?u=<uuid>&v=nope|yes&t=<hex hmac-sha256(secret, uuid + \"|\" + v)>\n * POST same query string plus a form field `reason`\n *\n * The token is the only authentication: the val is public and these links travel by email.\n * Everything is idempotent — mail clients prefetch links, and he may click twice.\n */\nimport * as db from \"./lib/db.ts\";\nimport { imageIdentity } from \"./lib/dedup.ts\";\nimport { verify } from \"./lib/sign.ts\";\n\nexport default async function (req: Request): Promise<Response> {\n if (new URL(req.url).pathname === \"/status\") return await status(req);\n const secret = Deno.env.get(\"FEEDBACK_SECRET\");\n if (!secret) {\n return new Response(\"feedback is not configured: FEEDBACK_SECRET is unset\\n\", {\n status: 503,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n const url = new URL(req.url);\n const uuid = url.searchParams.get(\"u\") ?? \"\";\n const kind = url.searchParams.get(\"v\") ?? \"\";\n const token = url.searchParams.get(\"t\");\n\n if (!uuid || (kind !== \"nope\" && kind !== \"yes\") || !(await verify(secret, uuid, kind, token))) {\n return new Response(\"403 — bad or missing token\\n\", {\n status: 403,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n await db.init();\n const post = await db.getPost(uuid);\n if (!post) return page(\"Unknown post.\", null, 404);\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const reason = String(form.get(\"reason\") ?? \"\").slice(0, 300).trim();\n if (reason) {\n await db.setFeedbackReason(uuid, kind, reason);\n console.log(\"FEEDBACK_REASON\", JSON.stringify({ uuid, kind, reason }));\n }\n return page(\"Noted. Thanks.\", null, 200);\n }\n\n const title = String(post.title ?? uuid);\n\n if (kind === \"nope\") {\n const keys = [\n ...(post.pid ? [`pid:${Number(post.pid)}`] : []),\n ...(post.repost_of ? [`pid:${Number(post.repost_of)}`] : []),\n ...String(post.image_ids ?? \"\").split(\",\").filter(Boolean).map((i) =>\n `img:${imageIdentity(i)}`\n ),\n ...(post.thumb_img_id ? [`img:${String(post.thumb_img_id)}`] : []),\n ];\n await db.addBlocked(keys, uuid, null);\n await db.updatePost(uuid, { status: \"rejected\", verdict: \"bad\" });\n if (!(await db.hasFeedback(uuid, \"nope\"))) await db.addFeedback(uuid, \"nope\", null);\n console.log(\"NOPE\", JSON.stringify({ uuid, keys }));\n return page(\n `Blocked: ${title}`,\n `${keys.length} key(s) suppressed. Why, in one line? (optional)`,\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n }\n\n await db.updatePost(uuid, { status: \"liked\" });\n if (!(await db.hasFeedback(uuid, \"yes\"))) await db.addFeedback(uuid, \"yes\", null);\n console.log(\"YES\", JSON.stringify({ uuid }));\n return page(\n `More like this: ${title}`,\n \"What made it good? (optional)\",\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n}\n\nconst esc = (s: string) =>\n s.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\");\n\nfunction page(\n heading: string,\n prompt: string | null,\n status: number,\n form?: { uuid: string; kind: string; token: string },\n): Response {\n const body = form && prompt\n ? `<form method=\"post\" action=\"?u=${encodeURIComponent(form.uuid)}&v=${\n encodeURIComponent(form.kind)\n }&t=${encodeURIComponent(form.token)}\">\n <p style=\"color:#555\">${esc(prompt)}</p>\n <input name=\"reason\" maxlength=\"300\" style=\"width:100%;padding:8px;font-size:15px\" autofocus>\n <button style=\"margin-top:8px;padding:8px 14px;font-size:15px\">save</button>\n</form>`\n : \"\";\n return new Response(\n `<!doctype html><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>cl-triage

${esc(heading)}

\n${body}\n`,\n { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n\n/**\n * GET /status with `Authorization: Bearer `.\n * Val Town's logs are not reachable from the API and `vt tail` is unreliable, so this is how\n * the tables get inspected from a terminal. The bearer is verified by asking api.val.town who it\n * belongs to and comparing with the owner named in VALTOWN_ENTRYPOINT; no second secret needed.\n */\nasync function status(req: Request): Promise {\n const json = (body: unknown, code = 200) =>\n new Response(JSON.stringify(body, null, 1), {\n status: code,\n headers: { \"content-type\": \"application/json; charset=utf-8\" },\n });\n const auth = req.headers.get(\"authorization\") ?? \"\";\n const owner = (Deno.env.get(\"VALTOWN_ENTRYPOINT\") ?? \"\").match(/esm\\.town\\/v\\/([^/]+)\\//)?.[1];\n if (!auth.startsWith(\"Bearer \") || !owner) return json({ error: \"unauthorized\" }, 401);\n const me = await fetch(\"https://api.val.town/v1/me\", {\n headers: { authorization: auth },\n signal: AbortSignal.timeout(8000),\n });\n if (!me.ok || (await me.json())?.username !== owner) return json({ error: \"unauthorized\" }, 401);\n\n await db.init();\n const limit = Number(new URL(req.url).searchParams.get(\"limit\") ?? \"20\");\n const t = await db.dumpTables(Math.min(Math.max(limit, 1), 200));\n const posts = t.posts.map((r) => ({\n uuid: r.uuid, search: r.search, title: r.title, price: r.price, status: r.status,\n verdict: r.verdict, score: r.score, reason: r.reason, flags: r.flags, dup_of: r.dup_of,\n attempts: r.attempts, queued_at: r.queued_at, judged_at: r.judged_at, emailed_at: r.emailed_at,\n }));\n return json({ posts, blocked: t.blocked.length, feedback: t.feedback });\n}\n",[],[223],"d2b98150-26bd-4fef-bb6e-2787fff9fef9","deno.json","e8bf8620-ace8-11f1-b2b3-1607ee4eb77e",58,["D",1789030157954],"{\n \"tasks\": {\n \"test\": \"deno test --allow-read=test/fixtures test/\",\n \"check\": \"deno check --allow-import=esm.town:443 lib/ inbox.email.tsx judge.cron.tsx feedback.http.tsx\",\n \"fmt\": \"deno fmt\",\n \"lint\": \"deno lint\",\n \"criteria\": \"deno run --allow-read --allow-env=HOME --allow-net=api.val.town scripts/push-criteria.ts\"\n },\n \"fmt\": {\n \"lineWidth\": 100,\n \"exclude\": [\n \"*.md\",\n \"research/\",\n \"test/fixtures/\"\n ]\n },\n \"compilerOptions\": {\n \"strict\": true\n }\n}\n",[],[231],"c80a41e1-c296-47b5-b399-1191650496cf","README.md","2e4ab7f4-acea-11f1-a894-1607ee4eb77e",53,["D",1789029306692],"# cl-triage\n\nCraigslist saved-search alerts → an LLM judge → one email with only the listings worth looking\nat. Runs on Val Town's free tier.\n\nCraigslist emails a saved-search alert whenever matching posts appear. Those alerts re-fire on\nevery renew, repost and edit, so the same item arrives over and over, and most of what arrives\nis not what you meant. This val parses each alert, fetches the real posting and its photos,\nasks Claude whether it matches criteria you wrote in plain English, and emails you only the\ngood ones — with a **nope** button that suppresses that listing (and its reposts and\ncrossposts) forever and teaches the judge what you don't want.\n\n## How it works\n\n```\ncraigslist alert -> inbox.email.tsx parse, cheap dedup, enqueue, then judge inline\n | SQLite: posts(uuid, pid, search, title, ..., status)\n |\n +--------> lib/drain.ts claim a row -> detail API -> dedup ladder\n | -> images -> one LLM call -> verdict\n | -> one email per drain\n v\n judge.cron.tsx the same drain, for the overflow: the rest of a\n | multi-result alert, backlog, retries\n v\n feedback.http.tsx the nope / more-like-this links, HMAC signed\n```\n\nAn alert is judged the moment it arrives — most alerts are a single result, and waiting for the\nnext cron tick would be latency for nothing. That is safe because the drain measures its\n40-second deadline from the *email handler's* start, so parsing counts against the same budget,\nand it will not begin a post without 38 seconds still in hand. Val Town's free tier kills a run\nat 60 seconds and *repeated* overruns temporarily pause the val, so the rule is that the inline\npass degrades by doing less, never by running longer: whatever it declines to start, the cron\ntakes. Because two drains can overlap, each post is claimed with a conditional UPDATE and only\none of them wins it.\n\nDuplicates are caught by a ladder of keys, strongest first: the numeric post id (stable across\nrenew), `repostOf` (craigslist records repost lineage itself), the sorted set of image ids\n(catches crossposts under different ids and different coordinates), and finally\ntitle + price + lat/lon rounded to three decimals. A duplicate inherits the original's verdict\nand costs no model call.\n\n## Environment variables\n\nAll configuration is in env vars, because a free-tier val is public and its source is\nworld-readable.\n\n| variable | required | what it is |\n|---|---|---|\n| `CRITERIA_JSON` | no (but the point) | `{\"default\": \"\", \"searches\": {\"\": \"\"}}` — what you actually want, per saved search |\n| `ANTHROPIC_API_KEY` | no | Without it the val runs in DRY_RUN: everything except the model call, verdict stored as `dry` |\n| `JUDGE_MODEL` | no | Defaults to `claude-sonnet-5` |\n| `FEEDBACK_SECRET` | yes for the buttons | HMAC key for the nope / more-like-this links. Without it the feedback endpoint answers 503 and the digest ships without buttons |\n| `FEEDBACK_URL` | no | The public URL of `feedback.http.tsx`. Discovered automatically at runtime if unset |\n| `SEND_IN_DRY_RUN` | no | `1` makes DRY_RUN still send the digest, for testing the email path |\n\n## Setup\n\n1. Set `CRITERIA_JSON`, `ANTHROPIC_API_KEY` and `FEEDBACK_SECRET` in the val's environment\n variables (sidebar in the Val Town editor), and set the cron interval on `judge.cron.tsx`\n (15 minutes is the free-tier minimum).\n2. Turn on the alert checkbox for each saved search in your craigslist account.\n3. In Gmail: Settings → Forwarding → add this val's inbound address (shown on\n `inbox.email.tsx` in the Val Town editor). Gmail sends a verification code to it; the\n handler stores that mail in blob `last-other-email`, so read the code with\n `blob.getJSON(\"last-other-email\")`.\n4. Add a Gmail filter `from:alerts@alerts.craigslist.org` → *Forward it to* that address, and\n probably *Skip the inbox* so only judged results land in front of you.\n5. Forward one alert by hand first and check the log line `ALERT {...}`.\n\n## Adding a search\n\nTick the alert box on the new saved search in craigslist. Nothing here needs to change: the\nalert subject is `(N new results) ` and that name is the key. Add an entry\nunder `searches` in `CRITERIA_JSON` when you want it judged on its own terms — until you do, it\nfalls back to `default` and logs `CRITERIA_FALLBACK`, so a new search is never silently dropped.\n\n## Being a good citizen\n\nRoughly one 2 KB JSON call and at most five cached images per alerted post — three orders of\nmagnitude under the 1,000 pages per 24 hours craigslist's own terms name. Browser-like\nUser-Agent, GET only, never `?format=rss`, never `/reply` or anything else robots.txt\ndisallows. If craigslist ever answers with its block page, the run logs the blockID, marks the\npost `blocked_by_cl` and stops. Do not retry it and do not move it to another IP.\n\n## Development\n\n```\ndeno task test # unit tests for the email parser, the dedup ladder and the link signing\ndeno task check # typecheck, including the esm.town imports\nvt push # deploy\n```\n",[],[239],"c918f213-b092-41f8-8345-6ba15e91e6ad",".vtignore","e7eae14a-ace8-11f1-8c88-1607ee4eb77e",57,["D",1789030157889],"# Never sync to Val Town. The val is PUBLIC (free tier = zero private vals), so\n# anything here is world-readable. Keep research notes, fixtures and secrets out.\n.env\n.env.*\n*.local\n\nPLAN.md\nCLAUDE.md\nresearch/\ntest/\nscratch/\n\n.git/\n\n# Lockfile is a local build artifact; Val Town resolves imports itself.\ndeno.lock\ncriteria.json\nscripts/\n",[],[247],"4afb64de-e43d-4e3a-85c7-c5448521df3a",".gitignore","e7f8b5a4-ace8-11f1-81ba-1607ee4eb77e",4,["D",1789025174910],".env\n.env.*\n*.local\n.vt/\nscratch/\n",[],[255],"77b700c6-5186-4dfd-a699-429343c6dbcf","sign.ts","e83bfcf6-ace8-11f1-8265-1607ee4eb77e",11,["D",1789025175351],"/**\n * HMAC-SHA256 over `|`, hex encoded, via Web Crypto (available in Deno and\n * on Val Town). The token is the only authentication the feedback endpoint has: the val is\n * public and the links go out in email, so the secret must never appear in source.\n */\n\nexport type FeedbackKind = \"nope\" | \"yes\";\n\nasync function hmacHex(secret: string, msg: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(msg));\n return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function sign(secret: string, uuid: string, kind: FeedbackKind | string): Promise {\n return hmacHex(secret, `${uuid}|${kind}`);\n}\n\nexport async function verify(\n secret: string,\n uuid: string,\n kind: string,\n token: string | null | undefined,\n): Promise {\n if (!token) return false;\n const expected = await sign(secret, uuid, kind);\n if (token.length !== expected.length) return false;\n // Constant time over the hex string.\n let diff = 0;\n for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ token.charCodeAt(i);\n return diff === 0;\n}\n",[],[173,263],["D",1789026338778],[],[173,65],"826c2430-3a31-4d09-af53-d9cc981dbcb4","mail.ts","e8045df0-ace8-11f1-8828-1607ee4eb77e",["D",1789025174997],"/**\n * The outgoing digest. One email per cron run, carrying every 'good' verdict from that run.\n *\n * Gmail rules (learned the hard way in the sibling calendar-val project):\n * -

History · parse.ts